v8.0.2

What's Changed

• fix: support GitHub OIDC immutable subject claims by Folarin Oyenuga (@FolarinOyenuga) in #131

New Contributors

• Folarin Oyenuga (@FolarinOyenuga) made their first contribution in #131

Full Changelog: 8.0.1...8.0.2

8.0.1

What's Changed

• pin sha by Emterry in #129
• fix: make github and circleci data blocks optional by JakeBroughton in #130

New Contributors

• Emterry made their first contribution in #129
• JakeBroughton made their first contribution in #130

Full Changelog: 8.0.0...8.0.1

8.0.0

Release 8.0.0 - BREAKING CHANGES

IRSA policy

This release introduces a change to the behaviour of IRSA IAM Policy creation for the ECR Module.

By default, no IRSA IAM policy will be created.

If you wish to have this created in order to query the AWS ECR API from your namespace (for example via the Cloud Platform AWS CLI service pod), then you'll need to pass in the following argument to your module call:

module "ecr" {
    ...
    ...
    enable_irsa = true
}

This change has been introduced to support Cloud Platform's effort in reducing the count of unused IAM policies

What's Changed

• feat: 🎸 updating module for toggling of irsa policy creation by Steve Williams (@sj-williams) in #127

Full Changelog: 7.1.1...8.0.0

v7.1.1

Bugfix

This release addresses issue where updating team_name CP environments Terraform variable forced recreate of ECR repository.

• fix: 🐛 introduce lifecycle ignore changes block for ecr name by Steve Williams (@sj-williams) in #126

Other Changes

• Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 in /test by Dependabot (@dependabot) in #104
• Bump github.com/hashicorp/go-getter from 1.7.1 to 1.7.4 in /test by Dependabot (@dependabot) in #108
• Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /test by Dependabot (@dependabot) in #111
• Bump golang.org/x/net from 0.17.0 to 0.23.0 in /test by Dependabot (@dependabot) in #107
• Bump github.com/hashicorp/go-getter from 1.7.1 to 1.7.5 in /test by Dependabot (@dependabot) in #115
• Update ecr.tf by Jaskaran Sarkaria (@jaskaransarkaria) in #120
• chore: 🤖 add terraform binary to test action by Steve Williams (@sj-williams) in #121
• Pin actions by Mike Bell (@mikebell) in #124
• docs: ✏️ clarify github environments condition by Steve Williams (@sj-williams) in #125
• fix: 🐛 introduce lifecycle ignore changes block for ecr name by Steve Williams (@sj-williams) in #126

Full Changelog: 7.1.0...7.1.1

7.1.0

What's Changed

• feat: add dependabot to cloud platform project workflow by Mike Bell (@mikebell) in #110
• Bump actions/setup-go from 2 to 5 by Dependabot (@dependabot) in #106
• Bump terraform-docs/gh-actions from 1.0.0 to 1.2.0 by Dependabot (@dependabot) in #112
• chore: bump example version by Tim Cheung (@timckt) in #117
• ♻️ Refactor GitHub Actions to Store ECR Registry URL as a Secret by Jason Birchall (@jasonBirchall) in #119

New Contributors

• Mike Bell (@mikebell) made their first contribution in #110
• Tim Cheung (@timckt) made their first contribution in #117

Full Changelog: 7.0.0...7.1.0

v7.0.0

What's Changed

• Update example to use the latest release by Poornima Krishnasamy (@poornima-krishnasamy) in #103
• Repo vars condition by Steve Williams (@sj-williams) in #109

Full Changelog: 6.1.1...7.0.0

Breaking Changes

Headline:
If optional github_environments field is set, any pre-existing default repository ECR secrets and variables will be deleted.

This release introduces functionality that could potentially break some existing GitHub Actions pipelines that utilise GitHub Secrets and Variables. Please read this guidance thoroughly and check that your GitHub Actions workflows are configured correctly.

Action required

If you’re using the ECR module in your environment, and are not setting the optional github_environments field, then this 7.0.0 update will have no impact on your CI/CD workflows and you can ignore this guidance.

If you are setting the github_environments field, then you should be accessing your ECR secrets and variables:

ECR_ROLE_TO_ASSUME
ECR_REGION
ECR_REPOSITORY
(these will vary if you are setting github_actions_prefix in your module call)

from your own defined GitHub environments within your repository workflows. This can be verified by reviewing your GitHub Actions yaml ECR build configurations and verifying that your ECR secrets and variables are scoped within an environment block, similar to the below workflow snippet:

on:
  push:
    branches: [main]

jobs:
  ecr:
  environment: development          # <-- Your environment name here
    runs-on: ubuntu-latest
    ...
    ...
    steps:
     ...
     # Assume role in Cloud Platform
     - uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.ECR_ROLE_TO_ASSUME }}          # <-- environment scoped secret
          aws-region: ${{ vars.ECR_REGION }}          # <-- environment scoped variable

Should you find any ECR secrets or variables that are referenced outside of an environment block's scope, then you are still using the default repository GitHub variables, and you must remediate before updating.

6.1.1

What's Changed

• Standardise tags and versions by Jake Mulley (@jakemulley) in #94
• Update README by Jake Mulley (@jakemulley) in #95
• Add output description, update README, add policy Sid to allow policy merging by Jake Mulley (@jakemulley) in #96
• Bump actions/checkout from 3 to 4 by Dependabot (@dependabot) in #97
• Bump version used in template and by CLI to latest release by Jake Mulley (@jakemulley) in #98
• feat(tf): add validation for modules variables by jackstockley89 in #101

New Contributors

• Dependabot (@dependabot) made their first contribution in #97
• jackstockley89 made their first contribution in #101

Full Changelog: 6.1.0...6.1.1

v6.1.0

What's Changed

• Bump example version by Jake Mulley (@jakemulley) in #91
• List + delete images by ushkarev in #93

New Contributors

• ushkarev made their first contribution in #93

Full Changelog: 6.0.0...6.1.0

v6.0.0

What's Changed

• Refactor .github/ directory to bring in line with cloud-platform-terraform-template by Jake Mulley (@jakemulley) in #83
• Add IRSA by Jake Mulley (@jakemulley) in #84
• Add canned lifecycle policies by Jake Mulley (@jakemulley) in #85
• Update example with latest release by Poornima Krishnasamy (@poornima-krishnasamy) in #86
• Update README and versions.tf by Jake Mulley (@jakemulley) in #88
• Remove ability to turn off scan_on_push by Jake Mulley (@jakemulley) in #89
• Remove access keys by Jake Mulley (@jakemulley) in #87
• Add tags by Jake Mulley (@jakemulley) in #90

Full Changelog: 5.3.0...6.0.0

5.3.0

What's Changed

• Bump example version by Jake Mulley (@jakemulley) in #80
• Fix incorrect link by David Elliott (@davidkelliott) in #81
• Ready for deletion by Steve Williams (@sj-williams) in #82

New Contributors

• David Elliott (@davidkelliott) made their first contribution in #81

Full Changelog: 5.2.0...5.3.0